Department of Environmental Health & Safety

Transcription

1 THE UNIVERSITY OF TEXAS-PAN AMERICAN OFFICE OF AUDITS & CONSULTING SERVICES Report No

2 OFFICE OF INTERNAL AUDITS THE UNIVERSITY OF TEXAS - PAN AMERICAN 1201 West University Drive Edinburg, Texas Office (956) January 27, 2014 Dr. Robert S. Nelsen, President The University of Texas-Pan American 1201 W. University Drive Edinburg, TX Dear Dr. Nelsen, As part of our fiscal year 2013 Audit Plan, we completed a departmental audit of the. The objective of the audit was to evaluate the adequacy and effectiveness of the s system of internal controls with an emphasis on financial and administrative controls. The specific internal control areas we focused on included the control conscious environment, approval and authorization, segregation of duties, safeguarding of assets, monitoring and information technology. Our scope encompassed activity from FY 2012 (September 1, 2011 through August 31, 2012). We performed audit procedures that included completion of an internal control questionnaire; interviews with staff; testing controls related to compliance with University policies and procedures; and performing substantive testing, on a sample basis, related to proper approvals of expenditures; time reporting; assets management; and segregation of duties. Overall, we concluded that the had established an adequate system of internal controls in the areas evaluated. However, we identified areas where improvements could be made to enhance internal controls. The detailed report is attached for your review. We appreciate the courtesy and cooperation received from management and staff during our audit. Sincerely, Eloy R. Alaniz, Jr., CPA, CIA, CISA Executive Director of Audits, Compliance & Consulting Services

3 The University of Texas Pan American Table of Contents EXECUTIVE SUMMARY 1 BACKGROUND 2 AUDIT OBJECTIVE 2 AUDIT SCOPE AND METHODOLOGY 2 AUDIT RESULTS 3 CONCLUSION 9

4 EXECUTIVE SUMMARY The mission of the Department of Environmental Health and Safety (department) is to ensure a safe and healthy work environment for faculty, staff, and students, to promote work practices that do not harm the environment, comply with any and all rules and regulations pertaining to occupational health and safety and the environment, and to protect University resources through sound administration of the University s insurance coverage. As required by The University of Texas System s (System) 1996 Action Plan to Enhance Internal Controls, an audit of departments should be performed every three (3) to five (5) years. The objective of the audit was to evaluate the adequacy and effectiveness of the department s system of internal controls with an emphasis on financial and administrative controls. The specific internal control areas we focused on included the control conscious environment, approval and authorization, segregation of duties, safeguarding of assets, monitoring and information technology. Our scope encompassed activity for fiscal year (FY) The audit was conducted in accordance with guidelines set forth in System s policy 129 and the Institute of Internal Auditor s International Standards for the Professional Practice of Internal Auditing. Overall, the department established an adequate system of financial and administrative internal controls; however, we observed the following: The department did not have a written policy and procedures manual; Not all staff performance evaluations were completed; Documentation was not maintained to support some purchases made with the department s procurement card; High risk inventory items were not tracked; Employee sick leave documentation did not support sick leave recorded on timecard; The department used unencrypted portable storage devices. No sensitive or confidential information was found on these devices. 1

5 BACKGROUND The following table summarizes the department s accounts as of August 31, Project Account Budget Encumbrances Actual Funds Available 100EVHS00 $473,981 $16,794 $455,967 $1, EVHS00 $966 $10,220 ($15,426) $6, VPBA00 $14,359 $1,999 $4,378 $7,982 21EVHS000 $454 $0 ($8) $462 21EVHS001 $36,775 $30,524 ($67) $6,319 70CMPT004 $7,098 $0 $7,098 $0 70EVHS000 $0 $0 $0 $0 70EVHS001 $3,300 $0 $3,300 $0 70EVHS002 $8,026 $32,295 $7,127 ($31,396) 70EVHS003 $0 $0 $0 $0 70EVHS004 $247,099 $248,374 $9,910 ($11,185) Total $792,058 $340,206 $472,279 ($20,426) AUDIT OBJECTIVE The objective of the audit was to evaluate the adequacy and effectiveness of the department s system of internal controls with an emphasis on financial and administrative controls. AUDIT SCOPE & METHODOLOGY We evaluated the department s internal controls related to establishing a control conscious environment, approval and authorization, segregation of duties, safeguarding of assets, monitoring, and information technology. Our scope included activity from FY 2012 (September 1, 2011 through August 31, 2012). To accomplish the audit objective, we performed the following procedures: We interviewed the director and discussed an internal control questionnaire to obtain an understanding of department operations and related internal controls. We also interviewed department employees for additional input on internal controls. We determined whether the director had established a control conscious environment, whether goals and objectives for the department had been developed, and whether a risk assessment and implementation plan had been developed. We determined whether account reconciliations had been performed and approved on a timely basis and whether segregation of duties existed. We determined whether the department had established adequate procedures and segregation of duties over funds handling. We examined operating and financial information for reliability. 2

6 We tested a sample of expenditures and examined supporting documentation for proper approval and authorization from the department s accounts with the most activity. We reviewed employee leave and tested timecards for proper approval and authorization. We performed property inventory testing for the existence of selected assets. We reviewed controls for personal computers and portable drives to evaluate physical and data security. We verified the department s compliance with University policies and procedures. The audit was conducted in accordance with guidelines set forth in System s policy UTS 129 Internal Audit Activities and the Institute of Internal Auditor s International Standards for the Professional Practice of Internal Auditing. The audit was conducted during the months of February through December Control Conscious Environment AUDIT RESULTS A control conscious environment encompasses technical competence and ethical commitment, and it is an important factor for the establishment of effective internal controls. In order to establish an adequate control conscious environment, a department should have the following: goals and objectives, a mission statement, a risk assessment and implementation plan, and a policies and procedures manual. These items should be updated on a regular basis. Additionally, employees should receive adequate training, performance evaluations should be conducted regularly and any conflicts of interest should be identified and addressed. Overall, we found that the department established an adequate control conscious environment. We selected eight (8) employees to test for completion of annual required trainings and nepotism certification. Additionally, we verified whether an annual performance evaluation had been performed. The results of our tests are as follows: 100% of the employees tested completed their sexual harassment training, 100% of the employees tested completed their annual standards of conduct training, 100% of the employees tested completed their annual compliance training, 100% of the employees tested completed their annual information security training, 100% of the employees tested completed their annual nepotism certifications, 6 out of 8 (75%) employees did not have an annual performance evaluation. We determined that the department did not have a written policy and procedures manual. 3

7 Recommendations: 1. Employee evaluations provide employees with positive reinforcement for effective job performance as well as constructive criticism in areas of job performance that do not meet standards. Therefore, the director should conduct timely employee evaluations. Management Response: 1. The Director of Environmental Health & Safety (DEHS) will immediately inform staff once their delinquency with trainings has been identified, and will continue to work with staff to ensure that all employees are up to date with required trainings. Implementation Date: December 16, The director should develop a department policies and procedures manual to help guide employees in the day-to-day operations. The manual should include information such as employee training requirements, account reconciliation processes, annual inventory certification procedures, information on security controls, and other relevant information. Management Response: 2. The DEHS is in the process of developing a policy and procedures manual that includes sections on the procedures identified by the audit recommendation as well as some additional sections unique to Environmental Health & Safety. Implementation Date: April 1, 2014 Approval & Authorization Adequately established approval and authorization controls help to ensure that expenditures are allowable and appropriate. During the audit period, the director was account manager for 11 project accounts. 4

8 We reviewed operating, travel, and payroll expenditures to test for compliance with University procedures. We tested a sample of expenditures in each category and examined supporting documentation for proper approval, accuracy, and whether the expenditures were reasonable. We also tested compliance with procurement card requirements. Operating and Travel Expenditures We randomly selected a sample of 17 operating and three (3) travel transactions representing 5% and 13% of the total dollar value of the population, respectively. We found that expenditures were properly approved, appropriate, and supported with adequate documentation. No exceptions were noted. Procurement Card We selected all transactions greater than $100 resulting in 15 procurement card expenses, which totaled 94% of the total dollar value of procurement card expenses. We tested those expenses for the following attributes: Cardholders completed the required training, Purchases made by authorized cardholders, Adequate documentation (i.e. itemized receipts, monthly transaction log, account statement, etc.) maintained to substantiate purchases, Purchases made in accordance with established guidelines, Reconciliations performed on purchases within seven days of the statement date. Overall, we determined that adequate controls over procurement cards were in place. All procurement card expenses were properly approved, reasonable and allowable, and adequate segregation of duties existed. However, we identified three (3) of the procurement card expenses tested were not supported by itemized receipts. Recommendation: 3. The director should maintain all itemized receipts to support expenditures made using the procurement card in accordance with procurement card requirements. Management Response: 3. The DEHS concurs with the audit recommendation. Action will be taken to ensure that itemized receipts are kept for all procurement card transactions. Implementation Date: 5

9 September 1, 2013 Payroll and Employee Leave We judgmentally selected 10 employees and selected the months of November 2011 and January 2012 to test for payroll accuracy. We verified that the employees compensation agreed with their memoranda of employment. We determined that the payroll for employees tested was accurate. We also evaluated the process for leave taken by employees, reconciliations of leave reports to the official timecard of the University, and ensured that timecards were properly approved by the employee s supervisor. The department relies on employees to request leave via . We judgmentally selected a sample of five (5) employees who either took vacation or sick leave during the months of November 2011 and January Based on our employee leave test, we found no discrepancies between employees approved vacation leave and the leave reported on their official University timecards. However, we noted two (2) instances where the sick time reported on the employees official timecard did not agree with sick leave documentation. The sick leave reported on the employee s timecards was more than the documentation maintained by the supervisor. All employee timecards tested were approved by their supervisor. Recommendation: 4. The director should ensure that adequate documentation is maintained to support employee leave recorded on the official University timecard. Management Response: 4. The current mechanism for documenting vacation (via ) has been expanded to include sick leave which traditionally is reported after someone had been absent. Employees are asked to send an to their respective supervisor when they arrive back to work outlining the days that they have been sick as documentation. Implementation Date: January 1,

10 Segregation of Duties Adequate segregation of duties should be maintained between the people who authorize transactions, record transactions, and have custody of assets. We reviewed areas such as revenues and funds handling, purchases, timecards and statement of account reconciliations to evaluate segregation of duties. The director had signature/approval authority over the department s accounts, including account reconciliations, purchases, and timecards. We reviewed a sample of the department s account reconciliations and determined that the preparer, reviewer and approver were separate individuals. We determined that the department did not handle cash. We concluded that adequate controls over segregation of duties for the areas evaluated were in place. Safeguarding of Assets Tangible assets, vital documents, critical systems, and confidential information must be safeguarded against unauthorized acquisition, use, or disposal. We performed property inventory testing to determine the existence of assets. Overall, we determined that the department established adequate controls over safeguarding of assets; however, we noted that improvements could be made in this area. We judgmentally selected a sample of 16 assets with a historical cost greater than $1,000 to test for existence. We were able to account for 15 out of the 16 assets tested. We also found that the department has items that did not meet the threshold for recording in the assets management system, but were of value to the department and were not tracked. Recommendation: 5. The director should develop an inventory items list to track high valued equipment not recorded on the central assets management system. Management Response: 5. The DEHS concurs with this recommendation, especially because at this time, the DEHS is not in one central location but occupies four different locations. An inventory list will be established identifying high valued equipment. Implementation Date: March 1,

11 Monitoring Monitoring is the assessment of internal controls over time. We reviewed the department s procedures for monitoring accounts, off-campus use of University property, and addressing complaints. Account reconciliations should be reviewed timely to ensure that any necessary account corrections are made. In accordance to Handbook of Operating Procedure Section 8.6.1: University Budget Policy/Fiscal Accountability, project managers are responsible for providing assurance as to the accuracy of their accounts by certifying that the account has been reconciled for the fiscal year and that all reconciling items have been satisfactorily resolved. Without adequate monitoring of project account reconciliations, items that require attention may go unnoticed. We reviewed two months of account reconciliations and determined that the account reconciliations were performed and reviewed timely. We also reviewed the department's process for handling complaints and personal use of University property. No exceptions were noted. Information Technology Adequately established information technology controls help to protect sensitive information entrusted to the department. These controls include limited access to the University s computer systems, and restricting downloads of sensitive information. Another control is encryption software on equipment storing sensitive information. Ensuring employees have appropriate levels of system access helps prevent loss of vital University data and also prevents other abuses of the system. We reviewed employee access levels for Oracle and verified that employees received appropriate level of access for their job responsibilities. We determined that all employees were granted the appropriate level of access to the Oracle system based on their individual job responsibilities. We inquired whether the department used portable storage devices such as external hard drives or thumb drives. We found that the department was using three (3) unencrypted thumb drives to back up information. While we did not find any sensitive or confidential information stored on these drives, these unencrypted portable storage devices pose a significant risk to the University. Because these devices are not secure, the potential exists for uploading harmful applications into the University's network. Recommendation: 6. The director should ensure all external storage devices such as thumb drives, external hard drives, etc. are encrypted. 8

12 Management Response: 6. The DEHS does not store sensitive or confidential information on USB drives, which are used primarily for training. The department has already obtained encrypted drives from the Security Office and is using the encrypted drives. Implementation Date: January 1, 2014 CONCLUSION Overall, we concluded that the department established an adequate system of financial and administrative controls. We identified areas where improvements could be made to internal controls and departmental procedures in the areas of control conscious environment; approval and authorization; safeguarding of assets; and information technology. These controls include developing a policies and procedures manual, ensuring that employees receive timely annual performance evaluations, maintaining documentation for employee sick leave as well as procurement card expenditures, and utilizing encrypted portable storage devices. Isabel Benavides CIA, CGAP, CFE Director, Audits and Consulting Services Khalil Abdullah, CIA, CGAP Internal Auditor I 9